ldpd/packet.c

   1 /*      $OpenBSD$ */
   2
   3 /*
   4  * Copyright (c) 2013, 2016 Renato Westphal <renato@openbsd.org>
   5  * Copyright (c) 2009 Michele Marchetto <michele@openbsd.org>
   6  * Copyright (c) 2004, 2005, 2008 Esben Norby <norby@openbsd.org>
   7  *
   8  * Permission to use, copy, modify, and distribute this software for any
   9  * purpose with or without fee is hereby granted, provided that the above
  10  * copyright notice and this permission notice appear in all copies.
  11  *
  12  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  13  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  14  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  15  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  16  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19  */
  20
  21 #include <zebra.h>
  22
  23 #include "ldpd.h"
  24 #include "ldpe.h"
  25 #include "log.h"
  26
  27 #include "sockopt.h"
  28
  29 static struct iface             *disc_find_iface(unsigned int, int,
  30                                     union ldpd_addr *);
  31 static int                       session_read(struct thread *);
  32 static int                       session_write(struct thread *);
  33 static ssize_t                   session_get_pdu(struct ibuf_read *, char **);
  34 static void                      tcp_close(struct tcp_conn *);
  35 static struct pending_conn      *pending_conn_new(int, int, union ldpd_addr *);
  36 static int                       pending_conn_timeout(struct thread *);
  37
  38 int
  39 gen_ldp_hdr(struct ibuf *buf, uint16_t size)
  40 {
  41         struct ldp_hdr  ldp_hdr;
  42
  43         memset(&ldp_hdr, 0, sizeof(ldp_hdr));
  44         ldp_hdr.version = htons(LDP_VERSION);
  45         /* exclude the 'Version' and 'PDU Length' fields from the total */
  46         ldp_hdr.length = htons(size - LDP_HDR_DEAD_LEN);
  47         ldp_hdr.lsr_id = ldp_rtr_id_get(leconf);
  48         ldp_hdr.lspace_id = 0;
  49
  50         return (ibuf_add(buf, &ldp_hdr, LDP_HDR_SIZE));
  51 }
  52
  53 int
  54 gen_msg_hdr(struct ibuf *buf, uint16_t type, uint16_t size)
  55 {
  56         static int      msgcnt = 0;
  57         struct ldp_msg  msg;
  58
  59         memset(&msg, 0, sizeof(msg));
  60         msg.type = htons(type);
  61         /* exclude the 'Type' and 'Length' fields from the total */
  62         msg.length = htons(size - LDP_MSG_DEAD_LEN);
  63         msg.id = htonl(++msgcnt);
  64
  65         return (ibuf_add(buf, &msg, sizeof(msg)));
  66 }
  67
  68 /* send packets */
  69 int
  70 send_packet(int fd, int af, union ldpd_addr *dst, struct iface_af *ia,
  71     void *pkt, size_t len)
  72 {
  73         union sockunion su;
  74
  75         switch (af) {
  76         case AF_INET:
  77                 if (ia && IN_MULTICAST(ntohl(dst->v4.s_addr))) {
  78                         /* set outgoing interface for multicast traffic */
  79                         if (sock_set_ipv4_mcast(ia->iface) == -1) {
  80                                 log_debug("%s: error setting multicast interface, %s", __func__, ia->iface->name);
  81                                 return (-1);
  82                         }
  83                 }
  84                 break;
  85         case AF_INET6:
  86                 if (ia && IN6_IS_ADDR_MULTICAST(&dst->v6)) {
  87                         /* set outgoing interface for multicast traffic */
  88                         if (sock_set_ipv6_mcast(ia->iface) == -1) {
  89                                 log_debug("%s: error setting multicast interface, %s", __func__, ia->iface->name);
  90                                 return (-1);
  91                         }
  92                 }
  93                 break;
  94         default:
  95                 fatalx("send_packet: unknown af");
  96         }
  97
  98         addr2sa(af, dst, LDP_PORT, &su);
  99         if (sendto(fd, pkt, len, 0, &su.sa, sockaddr_len(&su.sa)) == -1) {
 100                 log_warn("%s: error sending packet to %s", __func__,
 101                          log_sockaddr(&su.sa));
 102                 return (-1);
 103         }
 104
 105         return (0);
 106 }
 107
 108 /* Discovery functions */
 109 int
 110 disc_recv_packet(struct thread *thread)
 111 {
 112         int                      fd = THREAD_FD(thread);
 113         struct thread           **threadp = THREAD_ARG(thread);
 114
 115         union {
 116                 struct  cmsghdr hdr;
 117 #ifdef HAVE_STRUCT_SOCKADDR_DL
 118                 char    buf[CMSG_SPACE(sizeof(struct sockaddr_dl))];
 119 #else
 120                 char    buf[CMSG_SPACE(sizeof(struct in6_pktinfo))];
 121 #endif
 122         } cmsgbuf;
 123         struct msghdr            m;
 124         struct sockaddr_storage  from;
 125         struct iovec             iov;
 126         char                    *buf;
 127 #ifndef MSG_MCAST
 128         struct cmsghdr          *cmsg;
 129 #endif
 130         ssize_t                  r;
 131         int                      multicast;
 132         int                      af;
 133         union ldpd_addr          src;
 134         unsigned int             ifindex = 0;
 135         struct iface            *iface = NULL;
 136         uint16_t                 len;
 137         struct ldp_hdr           ldp_hdr;
 138         uint16_t                 pdu_len;
 139         struct ldp_msg           msg;
 140         uint16_t                 msg_len;
 141         struct in_addr           lsr_id;
 142
 143         /* reschedule read */
 144         *threadp = NULL;
 145         thread_add_read(master, disc_recv_packet, threadp, fd, threadp);
 146
 147         /* setup buffer */
 148         memset(&m, 0, sizeof(m));
 149         iov.iov_base = buf = pkt_ptr;
 150         iov.iov_len = IBUF_READ_SIZE;
 151         m.msg_name = &from;
 152         m.msg_namelen = sizeof(from);
 153         m.msg_iov = &iov;
 154         m.msg_iovlen = 1;
 155         m.msg_control = &cmsgbuf.buf;
 156         m.msg_controllen = sizeof(cmsgbuf.buf);
 157
 158         if ((r = recvmsg(fd, &m, 0)) == -1) {
 159                 if (errno != EAGAIN && errno != EINTR)
 160                         log_debug("%s: read error: %s", __func__,
 161                             strerror(errno));
 162                 return (0);
 163         }
 164
 165         sa2addr((struct sockaddr *)&from, &af, &src, NULL);
 166 #ifdef MSG_MCAST
 167         multicast = (m.msg_flags & MSG_MCAST) ? 1 : 0;
 168 #else
 169         multicast = 0;
 170         for (cmsg = CMSG_FIRSTHDR(&m); cmsg != NULL;
 171             cmsg = CMSG_NXTHDR(&m, cmsg)) {
 172 #if defined(HAVE_IP_PKTINFO)
 173                 if (af == AF_INET && cmsg->cmsg_level == IPPROTO_IP &&
 174                     cmsg->cmsg_type == IP_PKTINFO) {
 175                         struct in_pktinfo       *pktinfo;
 176
 177                         pktinfo = (struct in_pktinfo *)CMSG_DATA(cmsg);
 178                         if (IN_MULTICAST(ntohl(pktinfo->ipi_addr.s_addr)))
 179                                 multicast = 1;
 180                         break;
 181                 }
 182 #elif defined(HAVE_IP_RECVDSTADDR)
 183                 if (af == AF_INET && cmsg->cmsg_level == IPPROTO_IP &&
 184                     cmsg->cmsg_type == IP_RECVDSTADDR) {
 185                         struct in_addr          *addr;
 186
 187                         addr = (struct in_addr *)CMSG_DATA(cmsg);
 188                         if (IN_MULTICAST(ntohl(addr->s_addr)))
 189                                 multicast = 1;
 190                         break;
 191                 }
 192 #else
 193 #error "Unsupported socket API"
 194 #endif
 195                 if (af == AF_INET6 && cmsg->cmsg_level == IPPROTO_IPV6 &&
 196                     cmsg->cmsg_type == IPV6_PKTINFO) {
 197                         struct in6_pktinfo      *pktinfo;
 198
 199                         pktinfo = (struct in6_pktinfo *)CMSG_DATA(cmsg);
 200                         if (IN6_IS_ADDR_MULTICAST(&pktinfo->ipi6_addr))
 201                                 multicast = 1;
 202                         break;
 203                 }
 204         }
 205 #endif /* MSG_MCAST */
 206         if (bad_addr(af, &src)) {
 207                 log_debug("%s: invalid source address: %s", __func__,
 208                     log_addr(af, &src));
 209                 return (0);
 210         }
 211         ifindex = getsockopt_ifindex(af, &m);
 212
 213         /* find a matching interface */
 214         if (multicast) {
 215                 iface = disc_find_iface(ifindex, af, &src);
 216                 if (iface == NULL)
 217                         return (0);
 218         }
 219
 220         /* check packet size */
 221         len = (uint16_t)r;
 222         if (len < (LDP_HDR_SIZE + LDP_MSG_SIZE) || len > LDP_MAX_LEN) {
 223                 log_debug("%s: bad packet size, source %s", __func__,
 224                     log_addr(af, &src));
 225                 return (0);
 226         }
 227
 228         /* LDP header sanity checks */
 229         memcpy(&ldp_hdr, buf, sizeof(ldp_hdr));
 230         if (ntohs(ldp_hdr.version) != LDP_VERSION) {
 231                 log_debug("%s: invalid LDP version %d, source %s", __func__,
 232                     ntohs(ldp_hdr.version), log_addr(af, &src));
 233                 return (0);
 234         }
 235         if (ntohs(ldp_hdr.lspace_id) != 0) {
 236                 log_debug("%s: invalid label space %u, source %s", __func__,
 237                     ntohs(ldp_hdr.lspace_id), log_addr(af, &src));
 238                 return (0);
 239         }
 240         /* check "PDU Length" field */
 241         pdu_len = ntohs(ldp_hdr.length);
 242         if ((pdu_len < (LDP_HDR_PDU_LEN + LDP_MSG_SIZE)) ||
 243             (pdu_len > (len - LDP_HDR_DEAD_LEN))) {
 244                 log_debug("%s: invalid LDP packet length %u, source %s",
 245                     __func__, ntohs(ldp_hdr.length), log_addr(af, &src));
 246                 return (0);
 247         }
 248         buf += LDP_HDR_SIZE;
 249         len -= LDP_HDR_SIZE;
 250
 251         lsr_id.s_addr = ldp_hdr.lsr_id;
 252
 253         /*
 254          * For UDP, we process only the first message of each packet. This does
 255          * not impose any restrictions since LDP uses UDP only for sending Hello
 256          * packets.
 257          */
 258         memcpy(&msg, buf, sizeof(msg));
 259
 260         /* check "Message Length" field */
 261         msg_len = ntohs(msg.length);
 262         if (msg_len < LDP_MSG_LEN || ((msg_len + LDP_MSG_DEAD_LEN) > pdu_len)) {
 263                 log_debug("%s: invalid LDP message length %u, source %s",
 264                     __func__, ntohs(msg.length), log_addr(af, &src));
 265                 return (0);
 266         }
 267         buf += LDP_MSG_SIZE;
 268         len -= LDP_MSG_SIZE;
 269
 270         /* switch LDP packet type */
 271         switch (ntohs(msg.type)) {
 272         case MSG_TYPE_HELLO:
 273                 recv_hello(lsr_id, &msg, af, &src, iface, multicast, buf, len);
 274                 break;
 275         default:
 276                 log_debug("%s: unknown LDP packet type, source %s", __func__,
 277                     log_addr(af, &src));
 278         }
 279
 280         return (0);
 281 }
 282
 283 static struct iface *
 284 disc_find_iface(unsigned int ifindex, int af, union ldpd_addr *src)
 285 {
 286         struct iface    *iface;
 287         struct iface_af *ia;
 288
 289         iface = if_lookup(leconf, ifindex);
 290         if (iface == NULL)
 291                 return (NULL);
 292
 293         ia = iface_af_get(iface, af);
 294         if (!ia->enabled)
 295                 return (NULL);
 296
 297         /*
 298          * RFC 7552 - Section 5.1:
 299          * "Link-local IPv6 address MUST be used as the source IP address in
 300          * IPv6 LDP Link Hellos".
 301          */
 302         if (af == AF_INET6 && !IN6_IS_ADDR_LINKLOCAL(&src->v6))
 303                 return (NULL);
 304
 305         return (iface);
 306 }
 307
 308 int
 309 session_accept(struct thread *thread)
 310 {
 311         int                      fd = THREAD_FD(thread);
 312         struct sockaddr_storage  src;
 313         socklen_t                len = sizeof(src);
 314         int                      newfd;
 315         int                      af;
 316         union ldpd_addr          addr;
 317         struct nbr              *nbr;
 318         struct pending_conn     *pconn;
 319
 320         newfd = accept(fd, (struct sockaddr *)&src, &len);
 321         if (newfd == -1) {
 322                 /*
 323                  * Pause accept if we are out of file descriptors, or
 324                  * libevent will haunt us here too.
 325                  */
 326                 if (errno == ENFILE || errno == EMFILE) {
 327                         accept_pause();
 328                 } else if (errno != EWOULDBLOCK && errno != EINTR &&
 329                     errno != ECONNABORTED)
 330                         log_debug("%s: accept error: %s", __func__,
 331                             strerror(errno));
 332                 return (0);
 333         }
 334         sock_set_nonblock(newfd);
 335
 336         sa2addr((struct sockaddr *)&src, &af, &addr, NULL);
 337
 338         /*
 339          * Since we don't support label spaces, we can identify this neighbor
 340          * just by its source address. This way we don't need to wait for its
 341          * Initialization message to know who we are talking to.
 342          */
 343         nbr = nbr_find_addr(af, &addr);
 344         if (nbr == NULL) {
 345                 /*
 346                  * According to RFC 5036, we would need to send a No Hello
 347                  * Error Notification message and close this TCP connection
 348                  * right now. But doing so would trigger the backoff exponential
 349                  * timer in the remote peer, which would considerably slow down
 350                  * the session establishment process. The trick here is to wait
 351                  * five seconds before sending the Notification Message. There's
 352                  * a good chance that the remote peer will send us a Hello
 353                  * message within this interval, so it's worth waiting before
 354                  * taking a more drastic measure.
 355                  */
 356                 pconn = pending_conn_find(af, &addr);
 357                 if (pconn)
 358                         close(newfd);
 359                 else
 360                         pending_conn_new(newfd, af, &addr);
 361                 return (0);
 362         }
 363         /* protection against buggy implementations */
 364         if (nbr_session_active_role(nbr)) {
 365                 close(newfd);
 366                 return (0);
 367         }
 368         if (nbr->state != NBR_STA_PRESENT) {
 369                 log_debug("%s: lsr-id %pI4: rejecting additional transport connection", __func__, &nbr->id);
 370                 close(newfd);
 371                 return (0);
 372         }
 373
 374         session_accept_nbr(nbr, newfd);
 375
 376         return (0);
 377 }
 378
 379 void
 380 session_accept_nbr(struct nbr *nbr, int fd)
 381 {
 382 #ifdef __OpenBSD__
 383         struct nbr_params       *nbrp;
 384         int                      opt;
 385         socklen_t                len;
 386
 387         nbrp = nbr_params_find(leconf, nbr->id);
 388         if (nbr_gtsm_check(fd, nbr, nbrp)) {
 389                 close(fd);
 390                 return;
 391         }
 392
 393         if (nbrp && nbrp->auth.method == AUTH_MD5SIG) {
 394                 if (sysdep.no_pfkey || sysdep.no_md5sig) {
 395                         log_warnx("md5sig configured but not available");
 396                         close(fd);
 397                         return;
 398                 }
 399
 400                 len = sizeof(opt);
 401                 if (getsockopt(fd, IPPROTO_TCP, TCP_MD5SIG, &opt, &len) == -1)
 402                         fatal("getsockopt TCP_MD5SIG");
 403                 if (!opt) {     /* non-md5'd connection! */
 404                         log_warnx("connection attempt without md5 signature");
 405                         close(fd);
 406                         return;
 407                 }
 408         }
 409 #endif
 410
 411         nbr->tcp = tcp_new(fd, nbr);
 412         nbr_fsm(nbr, NBR_EVT_MATCH_ADJ);
 413 }
 414
 415 static int
 416 session_read(struct thread *thread)
 417 {
 418         int              fd = THREAD_FD(thread);
 419         struct nbr      *nbr = THREAD_ARG(thread);
 420         struct tcp_conn *tcp = nbr->tcp;
 421         struct ldp_hdr  *ldp_hdr;
 422         struct ldp_msg  *msg;
 423         char            *buf = NULL, *pdu;
 424         ssize_t          n, len;
 425         uint16_t         pdu_len, msg_len, msg_size, max_pdu_len;
 426         int              ret;
 427
 428         tcp->rev = NULL;
 429         thread_add_read(master, session_read, nbr, fd, &tcp->rev);
 430
 431         if ((n = read(fd, tcp->rbuf->buf + tcp->rbuf->wpos,
 432             sizeof(tcp->rbuf->buf) - tcp->rbuf->wpos)) == -1) {
 433                 if (errno != EINTR && errno != EAGAIN) {
 434                         log_warn("%s: read error", __func__);
 435                         nbr_fsm(nbr, NBR_EVT_CLOSE_SESSION);
 436                         return (0);
 437                 }
 438                 /* retry read */
 439                 return (0);
 440         }
 441         if (n == 0) {
 442                 /* connection closed */
 443                 log_debug("%s: connection closed by remote end", __func__);
 444                 nbr_fsm(nbr, NBR_EVT_CLOSE_SESSION);
 445                 return (0);
 446         }
 447         tcp->rbuf->wpos += n;
 448
 449         while ((len = session_get_pdu(tcp->rbuf, &buf)) > 0) {
 450                 pdu = buf;
 451                 ldp_hdr = (struct ldp_hdr *)pdu;
 452                 if (ntohs(ldp_hdr->version) != LDP_VERSION) {
 453                         session_shutdown(nbr, S_BAD_PROTO_VER, 0, 0);
 454                         free(buf);
 455                         return (0);
 456                 }
 457
 458                 pdu_len = ntohs(ldp_hdr->length);
 459                 /*
 460                  * RFC 5036 - Section 3.5.3:
 461                  * "Prior to completion of the negotiation, the maximum
 462                  * allowable length is 4096 bytes".
 463                  */
 464                 if (nbr->state == NBR_STA_OPER)
 465                         max_pdu_len = nbr->max_pdu_len;
 466                 else
 467                         max_pdu_len = LDP_MAX_LEN;
 468                 if (pdu_len < (LDP_HDR_PDU_LEN + LDP_MSG_SIZE) ||
 469                     pdu_len > max_pdu_len) {
 470                         session_shutdown(nbr, S_BAD_PDU_LEN, 0, 0);
 471                         free(buf);
 472                         return (0);
 473                 }
 474                 pdu_len -= LDP_HDR_PDU_LEN;
 475                 if (ldp_hdr->lsr_id != nbr->id.s_addr ||
 476                     ldp_hdr->lspace_id != 0) {
 477                         session_shutdown(nbr, S_BAD_LDP_ID, 0, 0);
 478                         free(buf);
 479                         return (0);
 480                 }
 481                 pdu += LDP_HDR_SIZE;
 482                 len -= LDP_HDR_SIZE;
 483
 484                 nbr_fsm(nbr, NBR_EVT_PDU_RCVD);
 485
 486                 while (len >= LDP_MSG_SIZE) {
 487                         uint16_t type;
 488
 489                         msg = (struct ldp_msg *)pdu;
 490                         type = ntohs(msg->type);
 491                         msg_len = ntohs(msg->length);
 492                         if (msg_len < LDP_MSG_LEN ||
 493                             (msg_len + LDP_MSG_DEAD_LEN) > pdu_len) {
 494                                 session_shutdown(nbr, S_BAD_MSG_LEN, msg->id,
 495                                     msg->type);
 496                                 free(buf);
 497                                 return (0);
 498                         }
 499                         msg_size = msg_len + LDP_MSG_DEAD_LEN;
 500                         pdu_len -= msg_size;
 501
 502                         /* check for error conditions earlier */
 503                         switch (type) {
 504                         case MSG_TYPE_INIT:
 505                                 if ((nbr->state != NBR_STA_INITIAL) &&
 506                                     (nbr->state != NBR_STA_OPENSENT)) {
 507                                         session_shutdown(nbr, S_SHUTDOWN,
 508                                             msg->id, msg->type);
 509                                         free(buf);
 510                                         return (0);
 511                                 }
 512                                 break;
 513                         case MSG_TYPE_KEEPALIVE:
 514                                 if ((nbr->state == NBR_STA_INITIAL) ||
 515                                     (nbr->state == NBR_STA_OPENSENT)) {
 516                                         session_shutdown(nbr, S_SHUTDOWN,
 517                                             msg->id, msg->type);
 518                                         free(buf);
 519                                         return (0);
 520                                 }
 521                                 break;
 522                         case MSG_TYPE_NOTIFICATION:
 523                                 break;
 524                         default:
 525                                 if (nbr->state != NBR_STA_OPER) {
 526                                         session_shutdown(nbr, S_SHUTDOWN,
 527                                             msg->id, msg->type);
 528                                         free(buf);
 529                                         return (0);
 530                                 }
 531                                 break;
 532                         }
 533
 534                         /* switch LDP packet type */
 535                         switch (type) {
 536                         case MSG_TYPE_NOTIFICATION:
 537                                 ret = recv_notification(nbr, pdu, msg_size);
 538                                 break;
 539                         case MSG_TYPE_INIT:
 540                                 ret = recv_init(nbr, pdu, msg_size);
 541                                 break;
 542                         case MSG_TYPE_KEEPALIVE:
 543                                 ret = recv_keepalive(nbr, pdu, msg_size);
 544                                 break;
 545                         case MSG_TYPE_CAPABILITY:
 546                                 ret = recv_capability(nbr, pdu, msg_size);
 547                                 break;
 548                         case MSG_TYPE_ADDR:
 549                         case MSG_TYPE_ADDRWITHDRAW:
 550                                 ret = recv_address(nbr, pdu, msg_size);
 551                                 break;
 552                         case MSG_TYPE_LABELMAPPING:
 553                         case MSG_TYPE_LABELREQUEST:
 554                         case MSG_TYPE_LABELWITHDRAW:
 555                         case MSG_TYPE_LABELRELEASE:
 556                         case MSG_TYPE_LABELABORTREQ:
 557                                 ret = recv_labelmessage(nbr, pdu, msg_size,
 558                                     type);
 559                                 break;
 560                         default:
 561                                 log_debug("%s: unknown LDP message from nbr %pI4",
 562                                     __func__, &nbr->id);
 563                                 if (!(ntohs(msg->type) & UNKNOWN_FLAG))
 564                                         send_notification(nbr->tcp,
 565                                             S_UNKNOWN_MSG, msg->id, msg->type);
 566                                 /* ignore the message */
 567                                 ret = 0;
 568                                 break;
 569                         }
 570
 571                         if (ret == -1) {
 572                                 /* parser failed, giving up */
 573                                 free(buf);
 574                                 return (0);
 575                         }
 576
 577                         /* no errors - update per neighbor message counters */
 578                         switch (type) {
 579                         case MSG_TYPE_NOTIFICATION:
 580                                 nbr->stats.notif_rcvd++;
 581                                 break;
 582                         case MSG_TYPE_KEEPALIVE:
 583                                 nbr->stats.kalive_rcvd++;
 584                                 break;
 585                         case MSG_TYPE_CAPABILITY:
 586                                 nbr->stats.capability_rcvd++;
 587                                 break;
 588                         case MSG_TYPE_ADDR:
 589                                 nbr->stats.addr_rcvd++;
 590                                 break;
 591                         case MSG_TYPE_ADDRWITHDRAW:
 592                                 nbr->stats.addrwdraw_rcvd++;
 593                                 break;
 594                         case MSG_TYPE_LABELMAPPING:
 595                                 nbr->stats.labelmap_rcvd++;
 596                                 break;
 597                         case MSG_TYPE_LABELREQUEST:
 598                                 nbr->stats.labelreq_rcvd++;
 599                                 break;
 600                         case MSG_TYPE_LABELWITHDRAW:
 601                                 nbr->stats.labelwdraw_rcvd++;
 602                                 break;
 603                         case MSG_TYPE_LABELRELEASE:
 604                                 nbr->stats.labelrel_rcvd++;
 605                                 break;
 606                         case MSG_TYPE_LABELABORTREQ:
 607                                 nbr->stats.labelabreq_rcvd++;
 608                                 break;
 609                         default:
 610                                 break;
 611                         }
 612
 613                         /* Analyse the next message */
 614                         pdu += msg_size;
 615                         len -= msg_size;
 616                 }
 617                 free(buf);
 618                 buf = NULL;
 619                 if (len != 0) {
 620                         session_shutdown(nbr, S_BAD_PDU_LEN, 0, 0);
 621                         return (0);
 622                 }
 623         }
 624
 625         /* shouldn't happen, session_get_pdu should be > 0 if buf was
 626          * allocated - but let's get rid of the SA warning.
 627          */
 628         free(buf);
 629         return (0);
 630 }
 631
 632 static int
 633 session_write(struct thread *thread)
 634 {
 635         struct tcp_conn *tcp = THREAD_ARG(thread);
 636         struct nbr      *nbr = tcp->nbr;
 637
 638         tcp->wbuf.ev = NULL;
 639
 640         if (msgbuf_write(&tcp->wbuf.wbuf) <= 0)
 641                 if (errno != EAGAIN && nbr)
 642                         nbr_fsm(nbr, NBR_EVT_CLOSE_SESSION);
 643
 644         if (nbr == NULL && !tcp->wbuf.wbuf.queued) {
 645                 /*
 646                  * We are done sending the notification message, now we can
 647                  * close the socket.
 648                  */
 649                 tcp_close(tcp);
 650                 return (0);
 651         }
 652
 653         evbuf_event_add(&tcp->wbuf);
 654
 655         return (0);
 656 }
 657
 658 void
 659 session_shutdown(struct nbr *nbr, uint32_t status, uint32_t msg_id,
 660     uint32_t msg_type)
 661 {
 662         switch (nbr->state) {
 663         case NBR_STA_PRESENT:
 664                 if (nbr_pending_connect(nbr))
 665                         THREAD_WRITE_OFF(nbr->ev_connect);
 666                 break;
 667         case NBR_STA_INITIAL:
 668         case NBR_STA_OPENREC:
 669         case NBR_STA_OPENSENT:
 670         case NBR_STA_OPER:
 671                 send_notification(nbr->tcp, status, msg_id, msg_type);
 672
 673                 nbr_fsm(nbr, NBR_EVT_CLOSE_SESSION);
 674                 break;
 675         default:
 676                 fatalx("session_shutdown: unknown neighbor state");
 677         }
 678 }
 679
 680 void
 681 session_close(struct nbr *nbr)
 682 {
 683         log_debug("%s: closing session with lsr-id %pI4", __func__,
 684             &nbr->id);
 685
 686         ldp_sync_fsm_nbr_event(nbr, LDP_SYNC_EVT_SESSION_CLOSE);
 687
 688         tcp_close(nbr->tcp);
 689         nbr_stop_ktimer(nbr);
 690         nbr_stop_ktimeout(nbr);
 691         nbr_stop_itimeout(nbr);
 692 }
 693
 694 static ssize_t
 695 session_get_pdu(struct ibuf_read *r, char **b)
 696 {
 697         struct ldp_hdr  l;
 698         size_t          av, dlen, left;
 699
 700         av = r->wpos;
 701         if (av < sizeof(l))
 702                 return (0);
 703
 704         memcpy(&l, r->buf, sizeof(l));
 705         dlen = ntohs(l.length) + LDP_HDR_DEAD_LEN;
 706         if (dlen > av)
 707                 return (0);
 708
 709         if ((*b = malloc(dlen)) == NULL)
 710                 return (-1);
 711
 712         memcpy(*b, r->buf, dlen);
 713         if (dlen < av) {
 714                 left = av - dlen;
 715                 memmove(r->buf, r->buf + dlen, left);
 716                 r->wpos = left;
 717         } else
 718                 r->wpos = 0;
 719
 720         return (dlen);
 721 }
 722
 723 struct tcp_conn *
 724 tcp_new(int fd, struct nbr *nbr)
 725 {
 726         struct tcp_conn         *tcp;
 727         struct sockaddr_storage  ss;
 728         socklen_t                len = sizeof(ss);
 729
 730         if ((tcp = calloc(1, sizeof(*tcp))) == NULL)
 731                 fatal(__func__);
 732
 733         tcp->fd = fd;
 734         evbuf_init(&tcp->wbuf, tcp->fd, session_write, tcp);
 735
 736         if (nbr) {
 737                 if ((tcp->rbuf = calloc(1, sizeof(struct ibuf_read))) == NULL)
 738                         fatal(__func__);
 739
 740                 tcp->rev = NULL;
 741                 thread_add_read(master, session_read, nbr, tcp->fd, &tcp->rev);
 742                 tcp->nbr = nbr;
 743         }
 744
 745         if (getsockname(fd, (struct sockaddr *)&ss, &len) != 0)
 746                 log_warn("%s: getsockname", __func__);
 747         else
 748                 sa2addr((struct sockaddr *)&ss, NULL, NULL, &tcp->lport);
 749         if (getpeername(fd, (struct sockaddr *)&ss, &len) != 0)
 750                 log_warn("%s: getpeername", __func__);
 751         else
 752                 sa2addr((struct sockaddr *)&ss, NULL, NULL, &tcp->rport);
 753
 754         return (tcp);
 755 }
 756
 757 static void
 758 tcp_close(struct tcp_conn *tcp)
 759 {
 760         /* try to flush write buffer */
 761         msgbuf_write(&tcp->wbuf.wbuf);
 762         evbuf_clear(&tcp->wbuf);
 763
 764         if (tcp->nbr) {
 765                 THREAD_READ_OFF(tcp->rev);
 766                 free(tcp->rbuf);
 767                 tcp->nbr->tcp = NULL;
 768         }
 769
 770         close(tcp->fd);
 771         accept_unpause();
 772         free(tcp);
 773 }
 774
 775 static struct pending_conn *
 776 pending_conn_new(int fd, int af, union ldpd_addr *addr)
 777 {
 778         struct pending_conn     *pconn;
 779
 780         if ((pconn = calloc(1, sizeof(*pconn))) == NULL)
 781                 fatal(__func__);
 782
 783         pconn->fd = fd;
 784         pconn->af = af;
 785         pconn->addr = *addr;
 786         TAILQ_INSERT_TAIL(&global.pending_conns, pconn, entry);
 787         pconn->ev_timeout = NULL;
 788         thread_add_timer(master, pending_conn_timeout, pconn, PENDING_CONN_TIMEOUT,
 789                          &pconn->ev_timeout);
 790
 791         return (pconn);
 792 }
 793
 794 void
 795 pending_conn_del(struct pending_conn *pconn)
 796 {
 797         THREAD_TIMER_OFF(pconn->ev_timeout);
 798         TAILQ_REMOVE(&global.pending_conns, pconn, entry);
 799         free(pconn);
 800 }
 801
 802 struct pending_conn *
 803 pending_conn_find(int af, union ldpd_addr *addr)
 804 {
 805         struct pending_conn     *pconn;
 806
 807         TAILQ_FOREACH(pconn, &global.pending_conns, entry)
 808                 if (af == pconn->af &&
 809                     ldp_addrcmp(af, addr, &pconn->addr) == 0)
 810                         return (pconn);
 811
 812         return (NULL);
 813 }
 814
 815 static int
 816 pending_conn_timeout(struct thread *thread)
 817 {
 818         struct pending_conn     *pconn = THREAD_ARG(thread);
 819         struct tcp_conn         *tcp;
 820
 821         pconn->ev_timeout = NULL;
 822
 823         log_debug("%s: no adjacency with remote end: %s", __func__,
 824             log_addr(pconn->af, &pconn->addr));
 825
 826         /*
 827          * Create a write buffer detached from any neighbor to send a
 828          * notification message reliably.
 829          */
 830         tcp = tcp_new(pconn->fd, NULL);
 831         send_notification(tcp, S_NO_HELLO, 0, 0);
 832         msgbuf_write(&tcp->wbuf.wbuf);
 833
 834         pending_conn_del(pconn);
 835
 836         return (0);
 837 }